CLEANKRF(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

💖 cleankrf — ok so we're cleaning up your DNSSEC-Tools keyrec files bestie 💖

Heyyy so this is the manual page for cleankrf(1), which lives in the User Contributed Perl Documentation section. She's a little perl script with big main character energy and she is SO ready to help you declutter. 🌸

✨ SYNOPSIS ✨

cleankrf [options] <keyrec-files>

🧹 DESCRIPTION 🧹

Okay so picture this: your keyrec files are your room, and they are lowkey a mess. cleankrf goes in and cleans the old data out of a whole set of DNSSEC-Tools keyrec files. The old data she's hunting for is: obsolete signing sets, orphaned keys, and obsolete keys. Three categories of clutter. Iconic of her honestly. 💅

Let's break down exactly what counts as what, because the details MATTER:

  • Obsolete signing sets are set keyrecs that no zone keyrec references. Also — and this is important — revoked signing sets are considered obsolete by cleankrf. So revoked = out. No cap.
  • Orphaned keys are KSK and ZSK key keyrecs that no set keyrec references. Nobody's claiming them, they're just... there. Orphans fr fr. 😭
  • Obsolete keys are key keyrecs with a keyrec_type of kskobs or zskobs.
🫶 Heads up bestie: cleankrf's exit code is the count of orphaned and obsolete keyrecs found. That's not a "did it work" 0-or-1 situation, that number is a quantity. Don't panic when it's not zero.

🎀 OPTIONS 🎀

  • -count — Show a final count of the old keyrecs found in the keyrec files. The cute part: this option makes the count show up even if you also passed -quiet. So it overrides the silence. She will speak. 👑
  • -list — The key keyrecs still get checked for old keyrecs, but nothing gets removed from the keyrec file. Instead, the names of the old keyrecs are displayed. Basically a window-shopping mode. No deleting, just looking. 🙈
  • -rm — Actually deletes the key files, both the .key and the .private ones, from orphaned and expired keyrecs. Like, both of them. Both. 👀
  • -quiet — Display no output. Shhh. 🤫
  • -verbose — Display output about referenced keys and unreferenced keys. Give her the mic. 🎤
  • -Version — Displays the version information for cleankrf and the DNSSEC-Tools package. (Capital V, bestie, don't come for me.) ✨
  • -help — Display a usage message. 🦋

Copyright 2004-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

👑 AUTHOR 👑

Wayne Morrison, tewok@tislabs.com

🌈 SEE ALSO 🌈

  • fixkrf(8), lskrf(8), zonesigner(8)
  • Net::DNS::SEC::Tools::keyrec.pm(3)
  • file-keyrec.pm(5)

And that's the whole vibe check, bestie — this was perl v5.42.0, dated 2025-07-23, straight from the CLEANKRF(1) page. Go forth and declutter. Slay. 💖✨🧚

📦 where this page comes from